HackerOne pentest pricing: what is published and what is not

HackerOne pentest pricing is not published. The company's pricing page shows no dollar amount for H1 Pentest or H1 Agentic Pentest, and every tier routes to a sales conversation. This page records what the vendor pages state, what they leave out, and what to put in a quote request. Facts come from the provider dataset, checked on 9 November 2026.

What does HackerOne publish about price?#

HackerOne publishes no pentest price. The table lists each item a buyer would look for and what the pages show.

Blog posts and AI answers give dollar ranges for HackerOne pentests. We do not repeat them. They come from third parties, and none is a HackerOne quote.

What is the price unit, and what does it buy?#

HackerOne has not stated a unit. A quote could price a pentest by test, by asset, by credit, by tester time or by year, and the pages do not say which. This matters because HackerOne sells two pentest products with different delivery:

• H1 Pentest is fully human-led. The wider scope list on the pages (web apps, APIs, cloud, network, mobile and AI apps) applies here.
• H1 Agentic Pentest pairs AI agents with human pentesters who review every agent finding. It covers web apps and APIs only.

Ask which product the quote covers, and ask for the unit in writing before you compare it with a per-test or per-asset price from another provider.

What costs extra or is not stated?#

The pricing page does not state add-ons, platform fees or support charges for pentests. The only metered unit on the page is monthly automations for the platform tiers, and that unit does not describe pentest effort. If you also run a bug bounty or disclosure program with HackerOne, ask whether the pentest sits inside a platform subscription or is billed on its own.

Fees can also appear after the work. HackerOne docs say a fee of at least $50 can be set for retests that are requested after the remediation window closes.

What do retests and turnaround look like?#

The retest terms are generous on paper and inconsistent across sources. The product page says retesting is included after remediation. HackerOne docs say retests are unlimited during the remediation period, typically 30 or 90 days, at no extra cost. Older docs and posts show a 60-day window with two retests.

Turnaround has no published start time or test length. The docs list the final report 3 to 5 business days after testing ends. That figure measures report delivery after the testing phase, so it tells you nothing about when testing begins.

How does a HackerOne quote compare in structure with other providers?#

A quote-only price cannot be compared with a published one until you convert it to the same unit. The cost guide explains why test, asset and credit prices differ. The table lists providers in our dataset that publish a price in a per-test unit, A to Z. Each price is a starting price or a one-off price on the date shown.

See Synack pricing and Aikido pricing for the details behind two of these rows. Scope differs between them: the Intruder AI pentest covers web apps only, and the Synack Sara Pentest covers one external web or host target.

What should you ask in the quote request?#

Send the same written request to every provider so the quotes line up. Ask for these items:

1. The product: H1 Pentest (human-led) or H1 Agentic Pentest.
2. The price unit and the total for your scope, split into pentest cost and any platform subscription.
3. The assets in scope, with counts of apps, APIs, user roles and environments.
4. The start date, test window and report date.
5. The retest window in days, the number of retests, and the fee after the window.
6. Whether a sample report is available before you sign.
7. Who reviews findings, and whether review applies to every finding.

Compare the quotes after you convert each one to a total for the same scope. Send corrections to the correction form if a HackerOne page now shows a price.